Meta's Muse Topped the App Charts, Amazon Blocked It, and a Researcher Found a Way In

Meta's Muse became the No. 1 free app on both US app stores within two weeks of launch, and it moved Meta's stock more than 11 percent on the day it got there; Wells Fargo raised its price target on the shares to $796 1. Sensor Tower counted over 902,000 downloads in the six days after Meta introduced the agent on September 8, 2026, ahead of the 773,000 the Meta AI app took in the same window, and more than 2.5 million in total by Monday 2.

Muse passed ChatGPT on Friday to lead the US iPhone App Store, and subscriptions run $20 or $100 a month 1. Over the same thirteen days from launch, Muse's cumulative downloads topped Claude's 400,000 and Grok's 200,000, while ChatGPT took 3.1 million 1.

Then two retailers answered the same agent in opposite ways. Amazon started blocking Muse from shopping on its site on Sunday night, September 20. Users who tried got a popup: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed" 3. Amazon says Meta never told it Muse would reach the store, that the agent does not identify itself when it browses, and that it appears to capture and store customer credentials; it has asked Meta to remove Amazon from the experience 3.

On Monday, Shopify went the other way. Its chief executive, Tobias Lütke, announced a partnership to enable agentic checkout with Shop Pay across Shopify stores 4, and Mark Zuckerberg posted that shoppers find more and shops sell more 5. Meta's own launch post had listed Shop Pay as coming soon 6.

The legal ground under that fight is uneven. Amazon won a preliminary injunction against Perplexity's shopping browser in March 2026 and lost it on August 4, when the Ninth Circuit ruled that the user — not the AI company — was the one accessing Amazon's computers under federal anti-hacking law. Rehearing was denied on September 10, which left claims built on contract terms open, and the message Muse users now see cites those terms rather than accusing anyone of hacking 3. Amazon's advertising business took in more than $68 billion last year and depends on people browsing its pages 3.

The security researcher Patrick Wardle took the Mac app apart and found that any locally installed app or terminal command can rewrite a long list of undocumented settings in Muse, whatever macOS permissions it holds. Most of those settings are harmless, such as dark mode. One controls the endpoint where Muse sends your dictation, normally a Meta server. An attacker points it at their own, and the account token comes with it — which is complete control of the Muse account 7. Wardle told Ars Technica that a simple variation of a ClickFix attack is all it takes to trigger, and that Meta's choice to run dictation in the cloud, where it can be logged, is what made the path possible 7.

His proof of concept is public on GitHub 8. On X he writes that it is trivial to turn Muse into a backdoor, and that a Mac already exploited this way reaches the user's other devices running Muse 9. Wardle, who founded the Objective-See Foundation and wrote The Art of Mac Malware, presents the work at Objective by the Sea in November 7.

Meta's answer came from its engineer David Singleton: a hotfix has gone out to the Muse Mac app, and the flaw is a local privilege escalation rather than a remote exploit, so using it to do harm requires malicious code already running on the machine under the user's own account 10. Meta's published design account says Muse runs on a dedicated secure virtual machine, with a separate agent called Sentinel that has to approve everything Muse sends to the internet, and credentials stored so the agent cannot read them 6.

Two things stay open: how many accounts, if any, were affected, and whether the hotfix closes every path Wardle found.

This episode raps it over a New Orleans bounce and trap beat: a chant hook, two verses for the two doors that opened and closed, and a third for the setting nobody documented.